Analysis

  • max time kernel
    133s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 00:24

General

  • Target

    SQLRayCLI.exe

  • Size

    4.6MB

  • MD5

    5513a3dc0c8872659886cf388fdab31e

  • SHA1

    75f3e3192f7e609a28f17411da685d384a8f1b99

  • SHA256

    9cfac085e4756ef55ffaba67307c1df15bfe14ea600065ad094f9c43c8499aa2

  • SHA512

    e2f11372d15f17b5059646f34707bb88ef37fbb26729fc5b82f86bfcc4372d8050f26bdd8cc799ea55c99a326b0b9122841af85581da9dbcd2d00ad925d13be2

  • SSDEEP

    98304:Gx6o7DEgTsuvi9fR106kiPZ5KjLQW9p0pxJ:Gx6YDxTlvqfR1Qzj0cWpr

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQLRayCLI.exe
    "C:\Users\Admin\AppData\Local\Temp\SQLRayCLI.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SQLRayCLI.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension ".tmp" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4680
    • \??\c:\Users\Admin\AppData\Local\Temp\51F.sqlraycli.tmp
      "C:\Users\Admin\AppData\Local\Temp\sqlray_services.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4744
    • \??\c:\Users\Admin\AppData\Local\Temp\B3D.sqlraycli.tmp
      "C:\Users\Admin\AppData\Local\Temp\SQLRayCLI.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          6d3e9c29fe44e90aae6ed30ccf799ca8

          SHA1

          c7974ef72264bbdf13a2793ccf1aed11bc565dce

          SHA256

          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

          SHA512

          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

        • C:\Users\Admin\AppData\Local\Temp\665.sqlraycli.tmp

          Filesize

          1KB

          MD5

          8fd1d495b09695f4fb95638213559464

          SHA1

          8525bec9fcc14bfb53145f339b5498c7d5948563

          SHA256

          21e178a283f66f767540ca84c2f2fe46bfe18add60a41f49a65ac4bdaae1f7a2

          SHA512

          80239f149715fccd6e0d615ace999b483315ec9451664352aea5953a321435964757721e5694e4dfbb3b8aab001621112332617b99eb95994d616160838a82a4

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k52izb4f.uky.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\config.yml

          Filesize

          214B

          MD5

          b2f54e952a76f7a26a817e55ed74cbb8

          SHA1

          cfd0aaa620eb21e8b0e6983d1c9da71eea041131

          SHA256

          a35030e632ea165c675260d8b86dfaf24a460ebc514f39988b1cc073bc4f6878

          SHA512

          af1663e1092ef8158b07b6528f3d731a48d378434cc32c1aea8c74bd8e782aaa412abec63a462e224a40d8cc29d0db6b663c56c49c5544e8bcfbea74b3a4d535

        • \??\c:\Users\Admin\AppData\Local\Temp\51F.sqlraycli.tmp

          Filesize

          1KB

          MD5

          86d23632843c402a3a34828bb99317c9

          SHA1

          ee7082dcee56cb61d0cae037078efb2a4b32eaae

          SHA256

          eef04cd51ee4cffc01ea5b13e1bf7a174cc4f093aef143471a31d16e20f9e280

          SHA512

          9a5fcf3158c96be1a48dff04d58ec15471d69f44a6a06ea5f2fcd2c858bd974bbfbfe31028cc85a321ae55f5d621038c5234dcf01757682c399b91dc007cb223

        • \??\c:\Users\Admin\AppData\Local\Temp\B3D.sqlraycli.tmp

          Filesize

          1KB

          MD5

          0989e97671939f5b29ceae47a923b168

          SHA1

          555deb232516cbcd21f52ea4043e3a6ac2dd97f9

          SHA256

          ac6bb5ea2fbce08df97b58a4ff107335c22f54a9f45efe256b28e0bbd0708ca2

          SHA512

          22191f895fcf02437fd6cbdd4030787f7604a0640ef0359db8f42f5a6846de3d9049b05982bc1a7f731af89c74508c6453520199b6ad92204e9a622236299658

        • memory/524-90-0x0000000140000000-0x0000000140412000-memory.dmp

          Filesize

          4.1MB

        • memory/524-83-0x0000000140000000-0x0000000140412000-memory.dmp

          Filesize

          4.1MB

        • memory/524-74-0x0000000140000000-0x0000000140412000-memory.dmp

          Filesize

          4.1MB

        • memory/780-34-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/780-18-0x000001C9E1BA0000-0x000001C9E1BC2000-memory.dmp

          Filesize

          136KB

        • memory/780-28-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/780-29-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/780-30-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-2-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-0-0x0000000140000000-0x000000014011D000-memory.dmp

          Filesize

          1.1MB

        • memory/1204-6-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-4-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-8-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-47-0x0000000004880000-0x0000000004EC1000-memory.dmp

          Filesize

          6.3MB

        • memory/1204-3-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-1-0x00007FFFFF0AD000-0x00007FFFFF0AE000-memory.dmp

          Filesize

          4KB

        • memory/1204-64-0x0000000140000000-0x000000014011D000-memory.dmp

          Filesize

          1.1MB

        • memory/1204-5-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-65-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/1204-7-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/4680-31-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/4680-38-0x00007FFFFF010000-0x00007FFFFF205000-memory.dmp

          Filesize

          2.0MB

        • memory/4744-71-0x0000000140000000-0x0000000140641000-memory.dmp

          Filesize

          6.3MB

        • memory/4744-50-0x0000000000110000-0x0000000000111000-memory.dmp

          Filesize

          4KB

        • memory/4744-62-0x0000000140000000-0x0000000140641000-memory.dmp

          Filesize

          6.3MB